Publicizing false testimony by medical expert witnesses:The chilling effect of Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Kathleen C. Reardon
Introduction"Frivolous lawsuits" are
perceived by many as a primary factor driving the spiral upward
in costs of health care. Those pushing for tort reform generally
favor enacting laws that place caps, or "maximum dollar
limits," on damages that a jury can award to a plaintiff
injured for the pain and suffering associated with alleged physician
malpractice. In addition to placing caps on awards for damages,
physicians who serve as "hired guns" to provide
expert testimony to support questionable claims of malpractice also should
be held accountable under the law and by their profession for providing
false or misleading testimony in support of a frivolous claim. Sadly,
this is not the case. Worse yet, honest physicians who seek public
redress against those who provide false or misleading testimony
are limited by the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) Privacy Rule1 in speaking publicly
in their own defense or in seeking to censure their reprobate colleagues.
The HIPAA Privacy Rule frustrates physicians
who, for the most part, operate as small business owners without
the staff or budget to spend on the complex web of compliance laws
that apply to such practices. The purpose of this article is to
discuss a restriction created by the Privacy Rule, perhaps unintentional,
that left mm physician-clients as frustrated by HIPAA as they were
angered by testimony believed to be false provided by an expert
witness in a malpractice claim in which one of them was a defendant.
In the eyes of my clients, HIPAA had become more than a compliance
nuisance; HIPAA was interfering with their First Amendment right
to speak out against what they perceived to be mistruths and was
preventing health care discourse which should be beneficial to the
public.
1The
Standards for Privacy of Individually Identifiable Health Information
45 CFR Parts 160 and 164 ("Privacy Rule") were
promulgated pursuant to the Health Insurance Portability and Accountability
Act of 1996 ("HIPAA").
Background
In the spring of 2004, our firm was
retained by a physician ("Physician") to provide
advice regarding potential legal liabilities arising from the proposed
publication of a journal article, which was to include patient information,
based on events that surrounded a medical malpractice trial in which the Physician
served as an expert witness for defendants. The Physician and another
physician involved in the trial ("Defendant") were
planning to collaborate in writing and publishing an article in
order to bring to the forefront the conduct of physicians who knowingly
provided treatment believed by the physicians to be false, or at
the very least, misleading, as expert medical witnesses in connection
with the trial. In particular, the Physician and the Defendant wanted
us to provide advice regarding their potential legal risk which
might arise from the HIPAA Privacy Rule for publication of a "post-mortem" article
about the particular medical malpractice case in which they both
were involved, albeit for different reasons.
The Defendant, a dermatopathologist,
was a party in the trial because he served on the Board of Directors
of a corporation that was sued as a result of a misdiagnosis. It
was he who brought to light the error in diagnosis of melanoma made
by two colleagues, pathologists in the same corporation. Those colleagues
had interpreted the lesion as a melanocytic nevus (i.e., a benign
neoplasm) 13 months earlier. This disclosure by the Defendant resulted
in a lawsuit that culminated in a jury verdict in favor of the Defendant
and other defendants.
This trial involved testimony believed
by the physicians to be false by one of the Plaintiff's
expert witnesses, a Professor of Dermatology at a leading Ivy League Medical
School. There would have been no trial and no case without this
testimony. In essence, the Plaintiff's witness testified
that the delay in diagnosis (of slightly over one year) of the melanoma
changed the patient's prognosis from very good to dismal.
This might have been accurate if the neoplasm were metastatic. The
Plaintiff's witness, in fact, agreed with the Physician
and the Defendant that the neoplasm was primary,
not metastatic, in the skin, however, the Plaintiff's witness
based the prognosis for the patient on data pertinent only to metastatic melanoma.
The Plaintiff's witness stated this viewpoint many times under
oath.
At the conclusion of the trial, the
Physician and the Defendant were so outraged by the false testimony
provided by the Plaintiff's expert witness that they both
sought to raise awareness on the part of the medical community and
the laity, of the all-too-frequent practice of physicians who fuel
the medical malpractice machine with false or misleading testimony,
in part through an article that would detail the egregious behavior
of the Plaintiff's expert physician involved in the trial.2 As
a professional courtesy, the doctors provided a draft of the article
to the Plaintiff's expert witness for comment that would
be published in conjunction with the article itself. After two attempts
to obtain response, the Defendant received a letter sent by a law
firm on behalf of the Plaintiff's expert witness, implying
that any further dissemination or publication of the article would
be in violation of HIPAA and other unspecified federal and state
laws, and might result in "legal action."
The Physician came to us for advice
regarding the validity of the legal claims threatened in the letter
and to seek advice on how to proceed with publication of the article.
We advised our clients to remove the name of the Plaintiff and of
the Defendant from the article, which they did, the reason being
that the Defendant was considered a "covered entity" under
the Privacy Rule, despite the fact that the trial was public and
brought to conclusion by the verdict of a jury. Unfortunately, our
advice left the Physician and the Defendant even more frustrated,
this time by HIPAA. The broad strokes created by HIPAA's
general disclosure prohibitions, the uncertain HIPAA enforcement
environment, and the uneven patchwork of litigation utilizing HIPAA
as the basis of claims3 created a legal risk that had
a chilling effect on their plan to publish the article in its original
form.
2 The
physicians also sent letters to the state physician licensing authorities
in Missouri and Boston, which elicited no response. In fact, as
the physicians discovered, a case brought before Missouri courts
in Missouri Board of Registration for the Healing Arts v.
Laurence A. Levine, M.D. 808 S.W.2D 440 (MO.APP.W.D.)
held that the Missouri Board of Healing Arts did not have jurisdiction
over physicians who provided false testimony in connection with
a malpractice action because such testimony does not constitute
the "practice of medicine" to which the Board's
jurisdiction is limited.
3 The
Department of Health and Human Services, Office of Civil Rights
is charged with enforcement authority violations of the HIPAA Privacy
Rule by covered entities. The OCR's enforcement authority
is limited to covered entities and the law does not provide individuals
with a private right of action to redress alleged violations of
the regulations. However, state and federal courts have "bootstrapped" the
privacy standards created by HIPAA to other legal claims.
Barrier created by the HIPAA
Privacy Rule
The Privacy Rule was intended to establish
a federal minimum baseline for patient information privacy, in part
to alleviate gaps in privacy created by the patchwork of patient
privacy laws in the fifty (50) States. Certain health care providers,
health plans, and health care clearinghouses are considered "covered
entities" under HIPAA and are prohibited from using or
disclosing patient information (defined under HIPAA as "protected
health information" or "PHI") without
specific authorization by a patient, except as permitted or required
by the Privacy Rule.4 Generally, the Privacy Rule permits the
use and disclosure of PHI without authorization by a patient in
order to facilitate patient care, obtain payment for health care
services, and accommodate various operations of the health care
industry. For example, a physician may disclose PHI to a patient's
insurance company for the purpose of obtaining payment for treatment,
or to another physician who is asked to consult on the diagnosis
and/or treatment of a patient. Similarly, a use or disclosure
of a patient's PHI by a physician in defense of a claim
of malpractice is deemed permissible as part of that physician's "health
care operations." The Privacy Rule, however, strictly circumscribes other uses
and disclosures. For instance, the exception that permits disclosure
for defense of a malpractice case would not permit
a physician to continue to speak or write about the case after the
claim has been settled or a verdict rendered. This contrasts with some
state laws that, as a rule, recognize implicitly a waiver of confidentiality
with respect to information placed at issue by a patient in the
context of malpractice litigation.
Most state laws provide some level of
protection for privacy of health information, often by extension
of the physician-patient privilege in regard to testimony. The physician-patient
privilege, which is at the heart of health privacy laws in many
states, is usually waived under state law when a patient brings
an action that places his or her medical condition at issue. The
physician-patient privilege codified in Missouri5 prohibits
a physician from disclosing medical information about a patient
during testimony in court or by formal discovery unless the patient
has explicitly or implicitly waived that privilege. Perhaps, more
importantly, Missouri courts have held that a patient implicitly waives his
or her privilege, and by extension, confidentiality about medical
treatment, by bringing an action that places his or her medical
condition at issue. The waiver is construed narrowly to only permit
disclosure of the condition at issue, but the waiver is not limited
to the purpose of the defense. In other words, a waiver of the physician-patient
privilege permits a physician to use that patient's information
in his or her defense, but also allows a physician to use the information beyond the
confines of the trial because the information has been placed in
the public domain.
HIPAA does not provide an exception
to its requirements for privacy, such as the implicit confidentiality
waiver recognized under state law through which a treating physician
may discuss the merits or other aspects of a case after resolution
of a claim, whether by settlement or by trial. The Privacy Rule generally
preempts contrary (or less protective) provisions of state law,
except where the state law is more stringent, (i.e., in cases where
the state law provides more protection to the privacy of
individually identifiable health information than that provided
by HIPAA). HIPAA, in this setting, is more stringent and provides
more protection of privacy on this score, and, therefore, preempts
those state laws that explicitly, or by their silence, permit a
physician to speak out about a particular patient's case
at the conclusion of a trial in order to reveal the false testimony
of an expert witness.
But what about our client, the Physician
who was the Defendant's expert witness? Our client was not
involved in any manner with the treatment of the Plaintiff and,
therefore, not constricted by the physician-patient privilege or
HIPAA. The Physician hoped that he would be free to use the case
information about the patient in the article, acting on the information
he gathered at the trial and in the public records of the court
compiled in the course of the trial. However, in addition to restricting
use and disclosure of PHI by covered entities, HIPAA also restricts
the use and disclosure of PHI by "business associates" of covered
entities. The Physician would arguably be a "business associate" of
the Defendant in his role as expert witness. Therefore, disclosures of PHI used
in the trial by another physician engaged by the Defendant for the
purpose of providing expert testimony also would be protected by
and subject to the redisclosure restrictions of the Privacy Rule. The Privacy
Rule, in its breadth, would arguably prevent the Physician as the
Defendant's expert witness from disclosing otherwise public "protected
health information" for purposes such as that of exposing
false testimony in a malpractice action.
4 The
Privacy Rule does not regulate PHI which has been disclosed pursuant
to a patient authorization or which has been released as required
by law to the extent that it is in the hands of individuals or entities
who are not subject to the Rule; that is, individuals or entities
which are not covered entities or business associates of
covered entities. Disclosures which fall into the "required
by law" category include disclosures made in response to
a valid subpoena when certain requirements for notice and opportunity
to object have been met.
5 Mo.
Rev. Stat. 491.060(5).
Conclusion and recommendations
The Privacy Rule prohibits the use or
disclosure of a patient's medical information by any treating or
consulting physician, even if the information is available in the
public domain. At the time the Privacy Rule was implemented, the
drafters of the rule acknowledged that the application of it to
the complex operations of the health care industry would identify
arenas for further interpretation and even revision. Delays by CMS
in providing guidance and interpretation of the
rules result in inefficiencies in the system of health care, legal
uncertainty, and as illustrated in the foregoing example, situations that
run counter to advancing First Amendment rights and the
objectives of health care discourse.
A simple clarification or the articulation
of an exception to the rule by Congress, the Office of Civil Rights,
or the courts would, at least, permit physicians to disclose publicly information
that already is available in the public domain and, arguably no
longer private or confidential and denounce those members of their
profession who feed "frivolous lawsuits" by providing
false testimony for unethical reasons, perhaps including personal
financial gain. Action by the Department of Health and Human Services or
clarification from the Office of Civil Rights would seem most efficient.
Kathleen
C. Reardon is Counsel at Bryan Cave, LLP in St. Louis, Missouri. Contact
author via e-mail: kcreardon@bryancave.com.
